Every move is journaled

Every state change in a PlaneSim world is a journaled command, and every world must replay byte-identically from that journal. This is the contract that keeps the economy honest, and the foundation the permanent archive stands on.

There is one rule underneath everything else in PlaneSim's engine: every state change in a world is a journaled command. Not most changes. Not the important ones. All of them.

When you found an airline, that is a command appended to the world's journal. When you retime a rotation, price a fare, or sign a lease, commands. When an AI rival takes a loan, starts a fare war, or goes bankrupt, those are commands too, in the same journal, through the same system players use. Nothing in the engine mutates world state any other way. A change that is not a command does not exist.

Replay, byte for byte

The contract has a second half that gives the first half its teeth: a world must replay byte-identically from its journal. Hand the engine a journal and it rebuilds the world it describes, exactly, down to the last cent in the last ledger entry. This is not a design aspiration. It is enforced by the test suite, and a world that replays differently is a broken build.

Byte-identical replay buys three things we consider non-negotiable.

First, the economy cannot silently cheat. AI carriers act through the same journaled commands as players, so there is no hidden channel through which a rival could be quietly handed money, aircraft, or demand. If it happened, it is in the record.

Second, bugs reproduce exactly. A strange number reported on a Tuesday is not a mystery to shrug at. We can replay the world to the moment it appeared and watch the engine produce it again, deterministically, as many times as the diagnosis takes.

Third, a world's history is complete. The journal is not a log about the world. It is the world, in a form that can be reconstructed at will.

Running economies never change under your feet

The contract shapes how features ship, too. Every gameplay-affecting change ships per-world and default-off. The code reaches every server on deploy, but an existing world keeps behaving exactly as it did until the feature is deliberately switched on for that specific world.

This sounds like caution. It is really a promise to players: a deploy will never silently rebalance the economy you have spent months learning. Your fleet plan, your fare structure, your read on a rival's weakness, none of it gets invalidated by a Tuesday release. When a world's rules change, it is a decision about that world, made on purpose, and visible.

The cost is real and we pay it knowingly. Features take longer to reach players, because shipping code is only half the job. Each live world carries its own configuration, and that configuration has to be managed deliberately. We think a persistent economy is worth exactly this much friction.

The archive is the payoff

Worlds run finite posted seasons, most of them two, six, or twelve months, with some open-ended. When a season ends, the world closes. It is never erased. Closed worlds are archived forever, and any signed-in account can read them.

The journal is what makes that promise more than marketing. An archive built from screenshots and summary tables is a scrapbook. An archive built on a journal is the actual world: every airline founded, every route opened and cut, every bankruptcy and every merger, preserved as the sequence of commands that made them happen. The first world has already completed its run and sits in the archive today, readable end to end. We wrote about what closing a world involves in When a world ends.

What this costs us day to day

Building this way is slower than the alternative, and it is worth being plain about how.

Every feature has to be expressed as commands with deterministic effects. There is no reaching into a live world to fix something by hand, because a hand-edit is precisely the kind of change the contract forbids. When a quick patch to state would be convenient, we cannot make one. That constraint is irritating roughly once a month and load-bearing every single day.

We accept the trade because the alternative is a genre norm we set out to beat: simulations whose numbers you have to take on faith. In PlaneSim the world can always be replayed, audited, and archived, and the engine has no way to lie about how it got here. The rest of the game, including the reference wiki written from the engine's code, stands on that.